rule win_unidentified_104_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.unidentified_104."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_104"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4c8d0d20070100 33c9 4c8d050f070100 488d1510070100 e8???????? 4885c0 }
            // n = 6, score = 100
            //   4c8d0d20070100       | dec                 ecx
            //   33c9                 | mov                 eax, dword ptr [edx + 0xa0]
            //   4c8d050f070100       | dec                 ecx
            //   488d1510070100       | mov                 ecx, edx
            //   e8????????           |                     
            //   4885c0               | dec                 ecx

        $sequence_1 = { 4c03e9 4d33cd 498bd9 49c1e918 48c1e328 4933d9 4803c3 }
            // n = 7, score = 100
            //   4c03e9               | xor                 edi, eax
            //   4d33cd               | dec                 eax
            //   498bd9               | mov                 edx, edi
            //   49c1e918             | dec                 eax
            //   48c1e328             | shl                 edi, 0x20
            //   4933d9               | dec                 eax
            //   4803c3               | shr                 edx, 0x20

        $sequence_2 = { 410fb6401b 4c0bc8 410fb6401a 49c1e108 4c0bc8 49c1e104 4c03c9 }
            // n = 7, score = 100
            //   410fb6401b           | cmovae              edx, dword ptr [ebp + 0x20]
            //   4c0bc8               | dec                 eax
            //   410fb6401a           | mov                 eax, 0x53c0af84
            //   49c1e108             | out                 dx, al
            //   4c0bc8               | xchg                eax, edx
            //   49c1e104             | push                -0x51
            //   4c03c9               | dec                 eax

        $sequence_3 = { 48c1e128 4933c9 4c8b8c2490000000 498b8180000000 4803c1 4803e8 4c33c5 }
            // n = 7, score = 100
            //   48c1e128             | dec                 eax
            //   4933c9               | mov                 dword ptr [ebx], eax
            //   4c8b8c2490000000     | dec                 eax
            //   498b8180000000       | mov                 eax, ebx
            //   4803c1               | dec                 eax
            //   4803e8               | add                 esp, 0x20
            //   4c33c5               | dec                 eax

        $sequence_4 = { 4883fa10 0f8288000000 48ffc2 488b4dc7 488bc1 483bd7 728f }
            // n = 7, score = 100
            //   4883fa10             | dec                 eax
            //   0f8288000000         | add                 eax, ecx
            //   48ffc2               | dec                 ecx
            //   488b4dc7             | lea                 ecx, [edx + 0x1000000]
            //   488bc1               | dec                 esp
            //   483bd7               | add                 ecx, eax
            //   728f                 | dec                 eax

        $sequence_5 = { 415d 415c 5f 5e 5d c3 488d5ed8 }
            // n = 7, score = 100
            //   415d                 | mov                 ebx, 0x31
            //   415c                 | mov                 edi, ebx
            //   5f                   | dec                 eax
            //   5e                   | lea                 edx, [ebp - 0x29]
            //   5d                   | dec                 eax
            //   c3                   | lea                 ecx, [ebp - 0x29]
            //   488d5ed8             | mov                 edi, 2

        $sequence_6 = { 418848fe c1e810 c1e918 418800 41884801 4d8d4004 4983e901 }
            // n = 7, score = 100
            //   418848fe             | dec                 eax
            //   c1e810               | lea                 ecx, [esp + 0x70]
            //   c1e918               | add                 cl, byte ptr [ebp + 0x4b]
            //   418800               | mov                 byte ptr [ebp + 0x41], al
            //   41884801             | dec                 ecx
            //   4d8d4004             | mov                 eax, esi
            //   4983e901             | mov                 byte ptr [ebp + 0x42], cl

        $sequence_7 = { e8???????? 33c0 4883c420 5b c3 8bd3 488bc8 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   33c0                 | shl                 cl, 6
            //   4883c420             | shr                 al, 2
            //   5b                   | and                 al, 0xf
            //   c3                   | add                 al, dl
            //   8bd3                 | add                 cl, byte ptr [ebp + 0x4b]
            //   488bc8               | mov                 dl, byte ptr [ebp + eax + 0x40]

        $sequence_8 = { 49c1e330 4c33da 4903f3 4889b424a0000000 4833ce 488b742418 488bd1 }
            // n = 7, score = 100
            //   49c1e330             | lea                 eax, [ecx + ecx]
            //   4c33da               | dec                 esp
            //   4903f3               | xor                 esp, eax
            //   4889b424a0000000     | dec                 ecx
            //   4833ce               | mov                 eax, dword ptr [esi + 0x70]
            //   488b742418           | dec                 ecx
            //   488bd1               | xor                 ecx, ecx

        $sequence_9 = { 7230 48ffc2 488b8dc0000000 488bc1 4881fa00100000 7215 }
            // n = 6, score = 100
            //   7230                 | dec                 ecx
            //   48ffc2               | xor                 ecx, ecx
            //   488b8dc0000000       | dec                 esp
            //   488bc1               | mov                 dword ptr [esp + 0x20], ecx
            //   4881fa00100000       | dec                 esp
            //   7215                 | mov                 ecx, ecx

    condition:
        7 of them and filesize < 263168
}